The invention relates to a method and system for safeguarding code words of a remotely actuated control system. An example of the mode of operation of a known remote control system, provided in particular for central locking systems of motor vehicles, is shown in German Patent 36 36 822 C1.
The code words of this remote control system are transmitted wirelessly by a remote transmitter and received by a receiver at the control system. The code words are protected against unauthorized recording and use by sychronizing the advancement of a portion, of each code word in the receiver and in the last-used transmitter. The algorithm, which produces the advancement, takes as its basis a normally unalterable key word stored in EEPROMs both in the receiver and in the transmitter.
Owing to the selected composition of each code word and of the algorithm used, which advances in one direction only, a code word which has been used can only recur identically after a very long period of time or a very large number of advances. The unauthorized reuse of an illegally recorded code word is thereby virtually excluded.
In addition to its algorithmically alterable portion, each code word of the generic remote control system can furthermore contain so-called system bits, which can be used for various distinctions--e.g. key types (main/secondary key), car make, key system, currently controllable function etc. According to one variant of the known system, these system bits are exempted from algorithmic alteration. One or more system bit (s) can however nevertheless be altered at will by the user of the transmitter--by switches provided in addition to the transmit button on the transmitter--in order to alter the function controllable or triggerable by the transmitter without influencing the advance algorithm.
While the door of the vehicle is open, the receiver can be switched manually to a "learning phase" by an electrical switch. In this learning phase, the key code word of the receiver is reprogramed, by the next code word transmitted to the receiver from an arbitrary transmitter compatible with the system in general. The system bits may also be reprogramed in the learning phase. This new key code word is then accepted and stored as the key code word underlying the advance in accordance with the predetermined algorithm upon each successive code-word transmission.
A code word stored in an available transmitter can be completely reset by removing the battery from the transmitter. The above-described `learning phase` of the receiver--using the transmitter with reset code--can then be carried out again. This is recommended in particular for shortening synchronization when the code words in transmitter and receiver have been advanced to a different extent. Of course, an unauthorized person can also carry out the resetting procedure described in the transmitter by temporary removal of the battery from the transmitter in his possession.
A remote control system of a central locking system shown in one embodiment of German Patent DE 32 44 049 C2, makes available, using a plurality of transmitters, a quantity of code words which differs from transmitter to transmitter.
Since the code words of this remote control system are also advanced algorithmically, measures must be taken, in dependence on the transmitter used, to limit the code advance to the limited code-word supply allocated individually to said transmitter. This avoids unnecessary resynchronization effort in the case of alternating transmitter use.
For this purpose, each transmitter is allocated different identification codes, which can be emitted first when the respective transmitter is actuated. For processing the code words which differs from transmitter, a decoding device connected downstream of the receiver is equipped with a plurality of decoding channels corresponding to the number of transmitters. Thus it is possible for said decoding channels to be switched on by the transmitter identification codes.
Nothing is mentioned of the nature of these transmitter identification codes in the last-mentioned patent. Functionally, they are to be equated with the arbitrarily alterable system bits of the generic remote control system and can be used, for identifying key types having different locking functions.
It is shown in German Patent DE 33 09 802 C2 to simplify th adaptation of standardized sensors (for tank filling, temperatures etc.) to the individual conditions in a particular motor vehicle with the aid of a ROM which contains vehicle-specific signal-conversion characteristics and impresses these on the signal-conversion arrangements provided between the sensors and their display instruments. But there is no indication that this can be used for the code words of a remote control system.
According to the invention, all code words generatable by the algorithmic advance includes at least one object-specific and unalterable basic portion of all code words. Since virtually any number of variations of a code-word portion can be produced with relatively little effort by electronic coding, it is possible to allocate to each object, i.e. even to each motor vehicle of a model series, its own, nowhere repeated, object-specific code.
Each transmitter belonging to the object is also allocated an unalterable basic portion of all code words.
This basic portion can be the same for all transmitters and then need be stored only once in the object.
In a preferred embodiment, each transmitter of the remote control system is allocated an individual, unalterable basic portion of all code words. This is consequently object--and transmitter-specific. In this embodiment, a total supply of all individual basic portions which corresponds at least to the number of transmitters supplied for independent parallel use must be stored in the object or receiver.
The permanent storage of the object-specific portions must be withdrawn from any write access storage, i.e. can, for example, be present in ROMs. It can be linked with the temporary storage of the alterable portions or, alternatively, be present in completely, i.e. even physically, separated memories. This has the advantage that, in contrast to the prior art, it is no longer possible to use any transmitter obtainable from a spare-parts dealer for storing a new current code word in the receiver, even when a transmitter RESET has been carried out and the mechanical safeguard has been overcome. This is because, although the object-specific, unalterable portions of the code words are still transmitted and prechecked for correspondence, they can under no circumstances effect alterations of the corresponding permanent memory contents in the object or receiver. It is obvious that the sale of replacement transmitters for such a system can be considerably better monitored and misuse made even more difficult. Exchange of the object-specific basic portions, once allocated, is only possible by exchanging the control device or the memories.
The basic portions can additionally contain user-specific portions which, upon transmitter actuation, impart certain user data to the receiver or object in advance. User-specific code portions of this kind are already known per se; in the automotive application of a remote control system. They act, for example, on adjustable vehicle components such as seats or rear-view mirrors.
Unauthorized use of the remote control system with a lost transmitter can be c very effectively by automatically invalidating--i.e. blocking or erasing each basic code-word portion which is allocated to a transmitter which has a) already been used at least once and b) has not been used in a read-in procedure. This automatic safeguarding function can be made dependent on various conditions:
the at least single use of the transmitter, the basic code-word portion of which is to be blocked, can be detected, for example, by recording a code advance procedure in the associated alterable portion of said code word;
the safeguarding function can in principle be carried out during the final acknowledgement of a read-in procedure performed with a plurality of transmitters; or
it can be carried out in dependence on the sequence of reading in, e.g. if, during the read-in procedure, a particular sequence is not complied with because one transmitter is missing. Here it is useful if the total supply of basic code-word portions stored in the object is somewhat larger than the number of transmitters supplied. An additional basic code-word portion, which has not yet been used, from the total supply can then be allocated to the transmitters to be newly acquired for the remote control system.
Other objects, advantages and novel features of the present invention will become apparent from the following detailed description of the invention when considered in conjunction with the accompanying drawings.